Fix Copilot setup workflow tool ordering

[Copilot]

Summary

• move Copilot environment setup steps ahead of restore/build/test so Node.js, Docker Buildx, and dotnet-ef are available before validation runs
• keep Node 24 aligned with the frontend engine requirement before dotnet build triggers npm ci
• make the dotnet-ef installation step idempotent and explicitly run under bash

Why

The failing Copilot agent run showed the setup workflow running dotnet build before actions/setup-node, and the Copilot setup docs state that if a setup step fails, the remaining setup steps are skipped. Because the web project runs npm ci during build and requires Node >=22, the agent could reach its task with Node setup skipped.

Validation

• dotnet restore /p:AccessToNugetFeed=false
• dotnet build --configuration Release --no-restore /p:AccessToNugetFeed=false
• dotnet test --no-build --configuration Release (still has the pre-existing failures in CaptchaService_Verify_Success and KnownBreachedPassword_IsDetected)
• python YAML parse of .github/workflows/copilot-setup-steps.yml
• dotnet build /home/runner/work/EssentialCSharp.Web/EssentialCSharp.Web/EssentialCSharp.Web/EssentialCSharp.Web.csproj --configuration Release --no-restore /p:AccessToNugetFeed=false after removing EssentialCSharp.Web/node_modules
• parallel_validation (Code Review + CodeQL security scan)

[Copilot]

Pull request overview

Reorders the Copilot agent environment setup workflow so prerequisite tooling (Node.js, Docker Buildx, EF tools) is available before restore/build/test, preventing builds that implicitly run npm ci from failing due to missing Node.

Changes:

• Move actions/setup-node ahead of restore/build/test to satisfy the frontend Node engine requirement during dotnet build.
• Move docker/setup-buildx-action earlier in the workflow.
• Make EF tooling setup idempotent (install vs update) and run it explicitly under bash.

[Copilot]

The workflow already pins dotnet-ef via the local tool manifest (.config/dotnet-tools.json), but this step installs/updates a global dotnet-ef to whatever the latest version is at runtime. That can introduce non-deterministic builds and version mismatches vs the repo’s pinned EF tooling (e.g., 10.0.7). Prefer running dotnet tool restore and using the restored tool (or install/update the global tool to the manifest’s pinned version) instead of updating to latest.

Suggested change

	echo "Installing additional tools for Copilot agent environment..."
	if dotnet tool list --global | grep -q 'dotnet-ef'; then
	dotnet tool update --global dotnet-ef
	else
	dotnet tool install --global dotnet-ef
	fi
	echo "Restoring local .NET tools for Copilot agent environment..."
	dotnet tool restore